Summary
- CERT-FR says numerous vulnerable Metabase deployments have been compromised through CVE-2026-72898.
- The SQL injection flaw can provide administrator access and expose credentials and data available through connected databases.
- Metabase had already identified attacks against its own cloud environment before issuing fixes in August.
France’s national cyber incident response team has warned of numerous compromises involving vulnerable Metabase installations, escalating a critical flaw disclosed in August into an active incident affecting exposed self-hosted analytics systems.
Metabase disclosed the underlying vulnerability after identifying attacks against its own cloud environment in early August. Tracked as CVE-2026-72898, the flaw enables an unauthenticated attacker to trigger SQL injection against the application’s database and obtain administrator-level access to a vulnerable instance.
In an alert issued on 10 September, CERT-FR said it was aware of numerous compromises of vulnerable Metabase systems. The agency urged affected organisations to apply patches as quickly as possible and investigate environments whose password-reset endpoint has been publicly accessible.
The vulnerability affects multiple supported Metabase branches. CERT-FR lists affected releases below x.58.28 and x.63.10, along with x.59 versions before x.59.25, x.60 before x.60.21, x.61 before x.61.15, and x.62 before x.62.13.
The exposure extends beyond control of the analytics application itself. Metabase connects to business databases and data warehouses so users can query and visualise corporate information. Administrator access can therefore give an attacker opportunities to alter application configuration, inspect connected data, create API keys, and obtain credentials stored for backend database connections.
Metabase’s own investigation began after a cloud customer reported an API key created outside normal working hours on 3 August. The company found a common source had performed the same sequence against two customer instances and traced the activity to a previously unknown weakness. It blocked the relevant endpoint across its managed environment before developing and deploying a patch.
Metabase said fewer than 3% of its cloud customers were compromised before the fix was applied, alongside some open-source and self-hosted users whose installations were publicly accessible. It also engaged an external incident response and forensic company as it examined the attack.
The flaw emerged from an interaction across several application layers rather than a single simple validation error. Metabase said the attack chain began at its password-reset endpoint and ultimately allowed crafted input to reach SQL generation logic in a form that could be abused to create an authenticated session. The attacker could then act as an administrator and create an API key for further access.
That design chain also prompted a broader hardening programme. Metabase has introduced additional schema validation, permissions work, controls around SQL generation, stronger handling of sensitive session values, and changes intended to reduce other classes of server-side request and query-processing risk.
CERT-FR’s latest alert changes the operational position for organisations that treated the August disclosure primarily as a patching event. Its statement that numerous vulnerable systems have now been compromised means exposure assessment cannot end with establishing that an upgrade has eventually been installed.
The French agency points to a characteristic sequence in application or ingress logs: a POST request to the password-reset endpoint returning HTTP 400, followed by a successful request for the current user. Metabase has previously said that observing that pattern is a strong indication that an instance may have been compromised.
For affected deployments, the vendor’s response steps include revoking active sessions, checking administrator accounts and API keys, rotating credentials for connected databases, and reviewing application and data-warehouse logs for unauthorised access. Those steps reflect the position Metabase can occupy between users and multiple data sources: compromise of the analytics layer can expose access paths into information held elsewhere.
The incident also illustrates the longer tail of critical software vulnerabilities. Metabase released its first fixes more than a month before CERT-FR’s alert, but public exposure and uneven upgrade cycles have left enough vulnerable systems online for compromise activity to continue. Once attackers have administrator access, later patching closes the vulnerability without establishing what may already have been accessed or changed.
